First part of OTP support

It's not complete but good enough to play with it for a while.

For now, it uses additional database table to store the secrets. I will rework it for LDAP when we put the necessary fields there.

It works like this: if you've got OTP disabled, you get verified ok straight after auth. If you've got it enabled, `/login` asks you for OTP after authing and you've got to get it right. I've set TOTP to the same parameters as Google for compatibility with random software, and made it accept clock drift around ±1 minute (so 5 codes are valid at a time).

There's also `/opt-setup` URI where you can disable and enable OTP, and generate a new secret key. The secrets are always random and encoded in base32. When a new secret is generated, it is stored in session and user is asked to confirm that he set it up successfully by entering OTP generated with it. If he does, new secret is written to the db and user can't obtain it afterwards. Otherwise, old secret stays active (if any).

I've added also a fancy qrcode with otpauth:// URI. Supposedly Google Authenticator knows how to handle it, so it'd be great if someone with a fancy phone could test it.

Lastly, I haven't added 'recovery codes' yet. If you lock yourself out, just drop the secret from the db :).